<!DOCTYPE html>
<html lang="en">
<head>
	<meta charset="UTF-8">
	<meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1">
	<title>Rollup overview | ElasticSearch 7.7 权威指南中文版</title>
	<meta name="keywords" content="ElasticSearch 权威指南中文版, elasticsearch 7, es7, 实时数据分析，实时数据检索" />
    <meta name="description" content="ElasticSearch 权威指南中文版, elasticsearch 7, es7, 实时数据分析，实时数据检索" />
    <!-- Give IE8 a fighting chance -->
    <!--[if lt IE 9]>
    <script src="https://oss.maxcdn.com/html5shiv/3.7.2/html5shiv.min.js"></script>
    <script src="https://oss.maxcdn.com/respond/1.4.2/respond.min.js"></script>
    <![endif]-->
	<link rel="stylesheet" type="text/css" href="../static/styles.css" />
	<script>
	var _link = 'rollup-overview.html';
    </script>
</head>
<body>
<div class="main-container">
    <section id="content">
        <div class="content-wrapper">
            <section id="guide" lang="zh_cn">
                <div class="container">
                    <div class="row">
                        <div class="col-xs-12 col-sm-8 col-md-8 guide-section">
                            <div style="color:gray; word-break: break-all; font-size:12px;">原英文版地址: <a href="https://www.elastic.co/guide/en/elasticsearch/reference/7.7/rollup-overview.html" rel="nofollow" target="_blank">https://www.elastic.co/guide/en/elasticsearch/reference/7.7/rollup-overview.html</a>, 原文档版权归 www.elastic.co 所有<br/>本地英文版地址: <a href="../en/rollup-overview.html" rel="nofollow" target="_blank">../en/rollup-overview.html</a></div>
                        <!-- start body -->
                  <div class="page_header">
<strong>重要</strong>: 此版本不会发布额外的bug修复或文档更新。最新信息请参考 <a href="https://www.elastic.co/guide/en/elasticsearch/reference/current/index.html" rel="nofollow">当前版本文档</a>。
</div>
<div id="content">
<div class="breadcrumbs">
<span class="breadcrumb-link"><a href="index.html">Elasticsearch Guide [7.7]</a></span>
»
<span class="breadcrumb-link"><a href="data-rollup-transform.html">Roll up or transform your data</a></span>
»
<span class="breadcrumb-link"><a href="xpack-rollup.html">Rolling up historical data</a></span>
»
<span class="breadcrumb-node">Rollup overview</span>
</div>
<div class="navheader">
<span class="prev">
<a href="xpack-rollup.html">« Rolling up historical data</a>
</span>
<span class="next">
<a href="rollup-api-quickref.html">Rollup API quick reference »</a>
</span>
</div>
<div class="section xpack">
<div class="titlepage"><div><div>
<h2 class="title">
<a id="rollup-overview"></a>Rollup overview<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/docs/reference/rollup/overview.asciidoc">edit</a><a class="xpack_tag" href="https://www.elastic.co/subscriptions"></a>
</h2>
</div></div></div>

<div class="warning admon">
<div class="icon"></div>
<div class="admon_content">
<p>This functionality is experimental and may be changed or removed completely in a future release. Elastic will take a best effort approach to fix any issues, but experimental features are not subject to the support SLA of official GA features.</p>
</div>
</div>
<p>Time-based data (documents that are predominantly identified by their timestamp) often have associated retention policies
to manage data growth.  For example, your system may be generating 500 documents every second.  That will generate
43 million documents per day, and nearly 16 billion documents a year.</p>
<p>While your analysts and data scientists may wish you stored that data indefinitely for analysis, time is never-ending and
so your storage requirements will continue to grow without bound.  Retention policies are therefore often dictated
by the simple calculation of storage costs over time, and what the organization is willing to pay to retain historical data.
Often these policies start deleting data after a few months or years.</p>
<p>Storage cost is a fixed quantity.  It takes X money to store Y data.  But the utility of a piece of data often changes
with time.  Sensor data gathered at millisecond granularity is extremely useful right now, reasonably useful if from a
few weeks ago, and only marginally useful if older than a few months.</p>
<p>So while the cost of storing a millisecond of sensor data from ten years ago is fixed, the value of that individual sensor
reading often diminishes with time.  It’s not useless — it could easily contribute to a useful analysis — but it’s reduced
value often leads to deletion rather than paying the fixed storage cost.</p>
<h4>
<a id="_rollup_stores_historical_data_at_reduced_granularity"></a>Rollup stores historical data at reduced granularity<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/docs/reference/rollup/overview.asciidoc">edit</a>
</h4>
<p>That’s where Rollup comes into play.  The Rollup functionality summarizes old, high-granularity data into a reduced
granularity format for long-term storage.  By "rolling" the data up into a single summary document, historical data
can be compressed greatly compared to the raw data.</p>
<p>For example, consider the system that’s generating 43 million documents every day.  The second-by-second data is useful
for real-time analysis, but historical analysis looking over ten years of data are likely to be working at a larger interval
such as hourly or daily trends.</p>
<p>If we compress the 43 million documents into hourly summaries, we can save vast amounts of space.  The Rollup feature
automates this process of summarizing historical data.</p>
<p>Details about setting up and configuring Rollup are covered in <a class="xref" href="rollup-put-job.html" title="Create rollup jobs API">Create Job API</a></p>
<h4>
<a id="_rollup_uses_standard_query_dsl"></a>Rollup uses standard query DSL<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/docs/reference/rollup/overview.asciidoc">edit</a>
</h4>
<p>The Rollup feature exposes a new search endpoint (<code class="literal">/_rollup_search</code> vs the standard <code class="literal">/_search</code>) which knows how to search
over rolled-up data.  Importantly, this endpoint accepts 100% normal Elasticsearch Query DSL.  Your application does not need to learn
a new DSL to inspect historical data, it can simply reuse existing queries and dashboards.</p>
<p>There are some limitations to the functionality available; not all queries and aggregations are supported, certain search
features (highlighting, etc) are disabled, and available fields depend on how the rollup was configured.  These limitations
are covered more in <a class="xref" href="rollup-search-limitations.html" title="Rollup search limitations">Rollup Search limitations</a>.</p>
<p>But if your queries, aggregations and dashboards only use the available functionality, redirecting them to historical
data is trivial.</p>
<h4>
<a id="_rollup_merges_live_and_rolled_data"></a>Rollup merges "live" and "rolled" data<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/docs/reference/rollup/overview.asciidoc">edit</a>
</h4>
<p>A useful feature of Rollup is the ability to query both "live", realtime data in addition to historical "rolled" data
in a single query.</p>
<p>For example, your system may keep a month of raw data.  After a month, it is rolled up into historical summaries using
Rollup and the raw data is deleted.</p>
<p>If you were to query the raw data, you’d only see the most recent month.  And if you were to query the rolled up data, you
would only see data older than a month.  The RollupSearch endpoint, however, supports querying both at the same time.
It will take the results from both data sources and merge them together.  If there is overlap between the "live" and
"rolled" data, live data is preferred to increase accuracy.</p>
<h4>
<a id="_rollup_is_multi_interval_aware"></a>Rollup is multi-interval aware<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/docs/reference/rollup/overview.asciidoc">edit</a>
</h4>
<p>Finally, Rollup is capable of intelligently utilizing the best interval available.  If you’ve worked with summarizing
features of other products, you’ll find that they can be limiting.  If you configure rollups at daily intervals…​ your
queries and charts can only work with daily intervals.  If you need a monthly interval, you have to create another rollup
that explicitly stores monthly averages, etc.</p>
<p>The Rollup feature stores data in such a way that queries can identify the smallest available interval and use that
for their processing.  If you store rollups at a daily interval, queries can be executed on daily or longer intervals
(weekly, monthly, etc) without the need to explicitly configure a new rollup job.  This helps alleviate one of the major
disadvantages of a rollup system; reduced flexibility relative to raw data.</p>
</div>
<div class="navfooter">
<span class="prev">
<a href="xpack-rollup.html">« Rolling up historical data</a>
</span>
<span class="next">
<a href="rollup-api-quickref.html">Rollup API quick reference »</a>
</span>
</div>
</div>

                  <!-- end body -->
                        </div>
                        <div class="col-xs-12 col-sm-4 col-md-4" id="right_col">
                        
                        </div>
                    </div>
                </div>
            </section>
        </div>
    </section>
</div>
<script src="../static/cn.js"></script>
</body>
</html>